@flowget/graph-validation 0.1.0

package/dist/template-ast.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Template-grammar classifier — the single parser both the builder's
+ * design-time verdict and the worker's pre-flight verdict run, so they
+ * classify `{{ … }}` templates IDENTICALLY.
+ *
+ * Lifted faithfully from the engine's `resolve-templates` classifier
+ * (`@flowget/engine`) and cross-checked against the builder's
+ * `template-highlight` classifier. Produces the `@flowget/types`
+ * {@link TemplateAst} shapes (designed for exactly this package). The
+ * engine will later ADOPT this shared classifier, so it must stay a faithful
+ * drop-in for the runtime resolver.
+ *
+ * ## ReDoS posture (this parses UNTRUSTED template strings)
+ *
+ * Every regex here is a SINGLE quantifier over a character class with no
+ * self-overlap — provably linear, no catastrophic backtracking:
+ *
+ *   - {@link TOKEN_RE} `\{\{[^{}]*\}\}` — one `*` over a negated class.
+ *   - {@link PATH_RE} `^[\w.-]+$` — one `+` over a class.
+ *
+ * The `??` fallback chain is split on the LITERAL two-character string
+ * `"??"` (`String.prototype.split("??")`), NOT a regex, so there is no
+ * `\s*\?\?\s*`-style backtracking surface at all. A defensive
+ * {@link MAX_TEMPLATE_LENGTH} cap bounds pathological inputs before the
+ * scan even starts.
+ */
+import type { TemplateAst, TemplateExpression, TemplatePath, TemplatePathKind } from "@flowget/types";
+/**
+ * Reserved top-level namespaces — always v1 semantics (flat walk, no
+ * `.output` envelope). Mirrors the engine resolver's `RESERVED_NAMESPACES`
+ * verbatim: `trigger` (trigger-payload), `workflow` + `input`
+ * (execution-level primitives).
+ */
+export declare const RESERVED_NAMESPACES: ReadonlySet<string>;
+/** `true` iff `token` is a reserved template namespace (`trigger` / `workflow` / `input`). */
+export declare function isReservedNamespace(token: string): boolean;
+/**
+ * Path tokens refused as a prototype-chain escape guard — mirrors the
+ * engine resolver's `FORBIDDEN_PATH_TOKENS`. A template naming any of
+ * these throws `forbidden_path_token` at runtime, so the static verdict
+ * flags it too.
+ */
+export declare const FORBIDDEN_PATH_TOKENS: ReadonlySet<string>;
+/** `true` iff any segment of `path` is a forbidden prototype-chain token. */
+export declare function hasForbiddenPathToken(path: TemplatePath): boolean;
+/**
+ * Defensive upper bound on a template-bearing string. Beyond this the
+ * string is treated as a single literal (no token scan) — a belt-and-
+ * suspenders cap on top of the already-linear regexes. Config template
+ * strings are short; this is far above any legitimate value.
+ */
+export declare const MAX_TEMPLATE_LENGTH = 50000;
+/**
+ * Classify a single operand's grammar off its first dot-separated token —
+ * a syntactic property of the path text, NOT of scope contents. Mirrors
+ * the engine resolver's `classifyOperand` exactly.
+ */
+export declare function classifyPathKind(raw: string): TemplatePathKind;
+/**
+ * Parse the inner text of a `{{ … }}` token (the part between the braces)
+ * into a {@link TemplateExpression}. Returns `null` when the inner text is
+ * NOT valid grammar — a `??` chain of one or more dotted-path operands.
+ *
+ * A `null` return means "not a Flowget template": the engine's resolver
+ * leaves such a token untouched (literal), so this package does too.
+ */
+export declare function parseTemplateExpression(inner: string): TemplateExpression | null;
+/**
+ * Parse a template-bearing string into a {@link TemplateAst}: an ordered
+ * list of literal / expression segments whose sources concatenate back to
+ * `raw`. A string with no valid `{{ … }}` token parses to a single
+ * `literal` segment. A `{{ … }}` whose inner text is not valid grammar is
+ * folded into the surrounding literal text (engine-faithful — the runtime
+ * resolver leaves it untouched).
+ */
+export declare function parseTemplate(raw: string): TemplateAst;
+/**
+ * `true` iff the whole string is exactly one `{{ … }}` expression (no
+ * surrounding literal text). This is the type-PRESERVING case: the field
+ * receives the referenced value's raw (typed) value, so
+ * {@link isAssignable} compares value-types. Any surrounding text makes it
+ * interpolation (a string result). Mirrors the engine's
+ * `WHOLE_STRING_RE` vs interpolation split.
+ */
+export declare function isWholeStringTemplate(ast: TemplateAst): boolean;
+/** `true` iff the AST carries at least one `{{ … }}` expression segment. */
+export declare function hasTemplateExpression(ast: TemplateAst): boolean;
+/** Every parsed expression segment in `ast`, in source order. */
+export declare function templateExpressions(ast: TemplateAst): readonly {
+    raw: string;
+    expression: TemplateExpression;
+}[];
+/**
+ * Raw `{{ … }}` token strings that LOOK like a template but are not valid
+ * grammar (would be passed through as literal text at runtime). Exposed
+ * for consumers that want a builder-style "looks broken" hint; deliberately
+ * NOT surfaced by {@link validateGraphStatic}, because a non-Flowget
+ * `{{ … }}` (a mail-merge template stored in a text field) is a legitimate
+ * literal — flagging it would be a false positive.
+ */
+export declare function findMalformedTemplateTokens(raw: string): string[];

package/dist/template-ast.js

@@ -0,0 +1,211 @@
+/**
+ * Template-grammar classifier — the single parser both the builder's
+ * design-time verdict and the worker's pre-flight verdict run, so they
+ * classify `{{ … }}` templates IDENTICALLY.
+ *
+ * Lifted faithfully from the engine's `resolve-templates` classifier
+ * (`@flowget/engine`) and cross-checked against the builder's
+ * `template-highlight` classifier. Produces the `@flowget/types`
+ * {@link TemplateAst} shapes (designed for exactly this package). The
+ * engine will later ADOPT this shared classifier, so it must stay a faithful
+ * drop-in for the runtime resolver.
+ *
+ * ## ReDoS posture (this parses UNTRUSTED template strings)
+ *
+ * Every regex here is a SINGLE quantifier over a character class with no
+ * self-overlap — provably linear, no catastrophic backtracking:
+ *
+ *   - {@link TOKEN_RE} `\{\{[^{}]*\}\}` — one `*` over a negated class.
+ *   - {@link PATH_RE} `^[\w.-]+$` — one `+` over a class.
+ *
+ * The `??` fallback chain is split on the LITERAL two-character string
+ * `"??"` (`String.prototype.split("??")`), NOT a regex, so there is no
+ * `\s*\?\?\s*`-style backtracking surface at all. A defensive
+ * {@link MAX_TEMPLATE_LENGTH} cap bounds pathological inputs before the
+ * scan even starts.
+ */
+/**
+ * Reserved top-level namespaces — always v1 semantics (flat walk, no
+ * `.output` envelope). Mirrors the engine resolver's `RESERVED_NAMESPACES`
+ * verbatim: `trigger` (trigger-payload), `workflow` + `input`
+ * (execution-level primitives).
+ */
+export const RESERVED_NAMESPACES = new Set([
+    "trigger",
+    "workflow",
+    "input",
+]);
+/** `true` iff `token` is a reserved template namespace (`trigger` / `workflow` / `input`). */
+export function isReservedNamespace(token) {
+    return RESERVED_NAMESPACES.has(token);
+}
+/**
+ * Path tokens refused as a prototype-chain escape guard — mirrors the
+ * engine resolver's `FORBIDDEN_PATH_TOKENS`. A template naming any of
+ * these throws `forbidden_path_token` at runtime, so the static verdict
+ * flags it too.
+ */
+export const FORBIDDEN_PATH_TOKENS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
+/** `true` iff any segment of `path` is a forbidden prototype-chain token. */
+export function hasForbiddenPathToken(path) {
+    return path.segments.some((s) => FORBIDDEN_PATH_TOKENS.has(s));
+}
+/**
+ * Defensive upper bound on a template-bearing string. Beyond this the
+ * string is treated as a single literal (no token scan) — a belt-and-
+ * suspenders cap on top of the already-linear regexes. Config template
+ * strings are short; this is far above any legitimate value.
+ */
+export const MAX_TEMPLATE_LENGTH = 50_000;
+/**
+ * Match a `{{ … }}` token. `[^{}]*` forbids interior braces so a
+ * malformed `{{ a {{ b }} }}` captures the inner `{{ b }}`, matching the
+ * builder's `TOKEN_RE` and the engine's interpolation scan. Linear.
+ */
+const TOKEN_RE = /\{\{[^{}]*\}\}/g;
+/** A single dotted path operand: word chars, dot, hyphen. One quantifier — linear. */
+const PATH_RE = /^[\w.-]+$/;
+/**
+ * Classify a single operand's grammar off its first dot-separated token —
+ * a syntactic property of the path text, NOT of scope contents. Mirrors
+ * the engine resolver's `classifyOperand` exactly.
+ */
+export function classifyPathKind(raw) {
+    const first = raw.split(".")[0] ?? "";
+    if (first === "steps")
+        return "v2-step";
+    if (RESERVED_NAMESPACES.has(first))
+        return "v1-reserved";
+    return "v1-step";
+}
+/**
+ * Parse the inner text of a `{{ … }}` token (the part between the braces)
+ * into a {@link TemplateExpression}. Returns `null` when the inner text is
+ * NOT valid grammar — a `??` chain of one or more dotted-path operands.
+ *
+ * A `null` return means "not a Flowget template": the engine's resolver
+ * leaves such a token untouched (literal), so this package does too.
+ */
+export function parseTemplateExpression(inner) {
+    const trimmed = inner.trim();
+    if (trimmed.length === 0)
+        return null;
+    // Split on the LITERAL `??` operator — no regex, no backtracking.
+    const parts = trimmed.split("??");
+    const operands = [];
+    for (const part of parts) {
+        const raw = part.trim();
+        // Every operand must be a non-empty dotted path. An empty operand
+        // (leading/trailing/doubled `??`) is malformed grammar → not a template.
+        if (!PATH_RE.test(raw))
+            return null;
+        operands.push({
+            kind: classifyPathKind(raw),
+            segments: raw.split("."),
+            raw,
+        });
+    }
+    // `parts` is always length ≥ 1 and every part passed PATH_RE, so
+    // `operands` is non-empty here — but keep the guard explicit.
+    if (operands.length === 0)
+        return null;
+    return { operands };
+}
+/**
+ * Parse a template-bearing string into a {@link TemplateAst}: an ordered
+ * list of literal / expression segments whose sources concatenate back to
+ * `raw`. A string with no valid `{{ … }}` token parses to a single
+ * `literal` segment. A `{{ … }}` whose inner text is not valid grammar is
+ * folded into the surrounding literal text (engine-faithful — the runtime
+ * resolver leaves it untouched).
+ */
+export function parseTemplate(raw) {
+    if (raw.length > MAX_TEMPLATE_LENGTH) {
+        return { raw, segments: [{ kind: "literal", text: raw }] };
+    }
+    const segments = [];
+    const pushLiteral = (text) => {
+        if (text.length === 0)
+            return;
+        const prev = segments[segments.length - 1];
+        if (prev !== undefined && prev.kind === "literal") {
+            // Coalesce adjacent literals so concatenation reproduces `raw`.
+            segments[segments.length - 1] = {
+                kind: "literal",
+                text: prev.text + text,
+            };
+            return;
+        }
+        segments.push({ kind: "literal", text });
+    };
+    let lastIndex = 0;
+    TOKEN_RE.lastIndex = 0;
+    let m;
+    while ((m = TOKEN_RE.exec(raw)) !== null) {
+        const tokenRaw = m[0];
+        if (m.index > lastIndex)
+            pushLiteral(raw.slice(lastIndex, m.index));
+        const expression = parseTemplateExpression(tokenRaw.slice(2, -2));
+        if (expression === null) {
+            pushLiteral(tokenRaw);
+        }
+        else {
+            segments.push({ kind: "expression", raw: tokenRaw, expression });
+        }
+        lastIndex = m.index + tokenRaw.length;
+    }
+    if (lastIndex < raw.length)
+        pushLiteral(raw.slice(lastIndex));
+    if (segments.length === 0)
+        segments.push({ kind: "literal", text: "" });
+    return { raw, segments };
+}
+/**
+ * `true` iff the whole string is exactly one `{{ … }}` expression (no
+ * surrounding literal text). This is the type-PRESERVING case: the field
+ * receives the referenced value's raw (typed) value, so
+ * {@link isAssignable} compares value-types. Any surrounding text makes it
+ * interpolation (a string result). Mirrors the engine's
+ * `WHOLE_STRING_RE` vs interpolation split.
+ */
+export function isWholeStringTemplate(ast) {
+    return ast.segments.length === 1 && ast.segments[0]?.kind === "expression";
+}
+/** `true` iff the AST carries at least one `{{ … }}` expression segment. */
+export function hasTemplateExpression(ast) {
+    return ast.segments.some((s) => s.kind === "expression");
+}
+/** Every parsed expression segment in `ast`, in source order. */
+export function templateExpressions(ast) {
+    const out = [];
+    for (const seg of ast.segments) {
+        if (seg.kind === "expression") {
+            out.push({ raw: seg.raw, expression: seg.expression });
+        }
+    }
+    return out;
+}
+/**
+ * Raw `{{ … }}` token strings that LOOK like a template but are not valid
+ * grammar (would be passed through as literal text at runtime). Exposed
+ * for consumers that want a builder-style "looks broken" hint; deliberately
+ * NOT surfaced by {@link validateGraphStatic}, because a non-Flowget
+ * `{{ … }}` (a mail-merge template stored in a text field) is a legitimate
+ * literal — flagging it would be a false positive.
+ */
+export function findMalformedTemplateTokens(raw) {
+    if (raw.length > MAX_TEMPLATE_LENGTH)
+        return [];
+    const out = [];
+    TOKEN_RE.lastIndex = 0;
+    let m;
+    while ((m = TOKEN_RE.exec(raw)) !== null) {
+        if (parseTemplateExpression(m[0].slice(2, -2)) === null)
+            out.push(m[0]);
+    }
+    return out;
+}

package/dist/validate-graph.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `validateGraphStatic(graph, catalog)` — the aggregator, and the single
+ * entry point the builder (pre-submit) and worker (pre-flight) both call.
+ * Because both feed the SAME `(graph, catalog)` into the SAME pure function,
+ * their verdicts are equal BY CONSTRUCTION.
+ *
+ * Runs, in order:
+ *   1. unknown node-type (a `WorkflowNode.type` absent from the catalog),
+ *   2. reference existence + reachability + whole-string type-compat,
+ *   3. declarative field rules (required / type / enum / min / max / pattern).
+ *
+ * The result is a flat, deterministically-ordered {@link ValidationIssue}[]
+ * — same input, same output, every time (no `Date` / random). This does NOT
+ * subsume the builder's architectural invariants (missing-trigger, cycle,
+ * decorator allow-list, per-node `validate()`); those remain the builder's,
+ * and a consumer concatenates both issue lists.
+ */
+import type { WorkflowGraph } from "@flowget/types";
+import { type CatalogNode } from "./catalog.js";
+import { type ValidationIssue } from "./issues.js";
+/**
+ * Statically validate a workflow graph against its node catalog.
+ *
+ * @param graph   The `@flowget/types` `WorkflowGraph` (nodes + edges).
+ * @param catalog The node definitions — a `readonly CatalogNode[]` (a
+ *                structural subset of `NodeMetadata<BuilderHints>[]`, so
+ *                pass `catalog.list()` / your registry array directly).
+ * @returns       Every static issue, most-structural first, with
+ *                deterministic ids. Filter by `severity === "error"` for the
+ *                blocking set.
+ */
+export declare function validateGraphStatic(graph: WorkflowGraph, catalog: readonly CatalogNode[]): ValidationIssue[];

package/dist/validate-graph.js

@@ -0,0 +1,53 @@
+/**
+ * `validateGraphStatic(graph, catalog)` — the aggregator, and the single
+ * entry point the builder (pre-submit) and worker (pre-flight) both call.
+ * Because both feed the SAME `(graph, catalog)` into the SAME pure function,
+ * their verdicts are equal BY CONSTRUCTION.
+ *
+ * Runs, in order:
+ *   1. unknown node-type (a `WorkflowNode.type` absent from the catalog),
+ *   2. reference existence + reachability + whole-string type-compat,
+ *   3. declarative field rules (required / type / enum / min / max / pattern).
+ *
+ * The result is a flat, deterministically-ordered {@link ValidationIssue}[]
+ * — same input, same output, every time (no `Date` / random). This does NOT
+ * subsume the builder's architectural invariants (missing-trigger, cycle,
+ * decorator allow-list, per-node `validate()`); those remain the builder's,
+ * and a consumer concatenates both issue lists.
+ */
+import { indexCatalog } from "./catalog.js";
+import { collectFieldRuleIssues } from "./field-rules.js";
+import { finalizeIssues, ISSUE_CODES, } from "./issues.js";
+import { collectReferenceIssues } from "./references.js";
+/**
+ * Statically validate a workflow graph against its node catalog.
+ *
+ * @param graph   The `@flowget/types` `WorkflowGraph` (nodes + edges).
+ * @param catalog The node definitions — a `readonly CatalogNode[]` (a
+ *                structural subset of `NodeMetadata<BuilderHints>[]`, so
+ *                pass `catalog.list()` / your registry array directly).
+ * @returns       Every static issue, most-structural first, with
+ *                deterministic ids. Filter by `severity === "error"` for the
+ *                blocking set.
+ */
+export function validateGraphStatic(graph, catalog) {
+    const index = indexCatalog(catalog);
+    const raw = [];
+    // 1. Unknown node type — a node whose `type` has no catalog entry. The
+    //    engine rejects such a node before executing; surface it up front.
+    for (const node of graph.nodes) {
+        if (!index.has(node.type)) {
+            raw.push({
+                code: ISSUE_CODES.UNKNOWN_NODE_TYPE,
+                severity: "error",
+                nodeId: node.id,
+                message: `Node "${node.id}" has unknown type "${node.type}" — no such node in the catalog.`,
+            });
+        }
+    }
+    // 2. Template references (existence + reachability + type-compat).
+    raw.push(...collectReferenceIssues(graph, index));
+    // 3. Declarative field rules.
+    raw.push(...collectFieldRuleIssues(graph, index));
+    return finalizeIssues(raw);
+}

package/dist/value-type.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The coarse value-type lattice — the zero-false-positive comparator the
+ * strict-validation epic is built on. Reasons ONLY over the
+ * `@flowget/types` {@link FieldValueType} set; it never sees a live schema
+ * or a refinement (`.int()`, `.positive()`, `.literal()`) — those stay
+ * enforced at runtime by the consumer's zod. The honesty boundary: a
+ * "valid" verdict here must NEVER be wrong, so the lattice is permissive
+ * wherever it cannot be certain.
+ */
+import type { FieldValueType } from "@flowget/types";
+/** `true` iff `t` is a permissive wildcard (`unknown` / `object` / `array`). */
+export declare function isWildcardValueType(t: FieldValueType): boolean;
+/** `true` iff `t` is a concrete scalar leaf (`string` / `number` / `boolean` / `date`). */
+export declare function isConcreteScalar(t: FieldValueType): boolean;
+/**
+ * Position-aware assignability, WHOLE-STRING semantics — the case where a
+ * `{{ steps.x.output.y }}` token IS the entire field value, so the
+ * consumer field receives `y`'s raw (type-preserving) value.
+ *
+ * The lattice:
+ *
+ *   - Either side a wildcard (`unknown` / `object` / `array`) → assignable
+ *     (permissive; zero false positives).
+ *   - `date` ↔ `string` → assignable ({@link isDateStringPair} — dates ARE
+ *     JSON strings).
+ *   - Otherwise both CONCRETE scalars → assignable iff EQUAL. Two disjoint
+ *     concrete scalars (e.g. a `number` output into a `string`-expecting
+ *     input) are the ONLY thing this function flags.
+ *
+ * Interpolation (a `{{ … }}` embedded in surrounding text) is NOT checked
+ * through here: the result is always a string and every coarse producer is
+ * stringifiable, so interpolation never yields a type-mismatch verdict.
+ */
+export declare function isAssignable(producer: FieldValueType, consumer: FieldValueType): boolean;
+/**
+ * Coarse {@link FieldValueType} of a concrete JavaScript value — used to
+ * check a LITERAL (non-template) config value against its field's declared
+ * value type. `null` / `undefined` map to `unknown` (permissive) so an
+ * absent value is never a type mismatch (required-ness is a separate rule).
+ */
+export declare function jsValueType(value: unknown): FieldValueType;

package/dist/value-type.js

@@ -0,0 +1,94 @@
+/**
+ * The coarse value-type lattice — the zero-false-positive comparator the
+ * strict-validation epic is built on. Reasons ONLY over the
+ * `@flowget/types` {@link FieldValueType} set; it never sees a live schema
+ * or a refinement (`.int()`, `.positive()`, `.literal()`) — those stay
+ * enforced at runtime by the consumer's zod. The honesty boundary: a
+ * "valid" verdict here must NEVER be wrong, so the lattice is permissive
+ * wherever it cannot be certain.
+ */
+/**
+ * The permissive wildcards. `unknown` is an undeclared/opaque shape;
+ * `object` / `array` are compound shapes whose element/nested types this
+ * coarse lattice cannot see (a drill-in path under an `object` resolves to
+ * an undeclared deeper type). All three are assignable to/from ANYTHING so
+ * the comparator produces zero false positives.
+ */
+const WILDCARD_VALUE_TYPES = new Set([
+    "unknown",
+    "object",
+    "array",
+]);
+/** `true` iff `t` is a permissive wildcard (`unknown` / `object` / `array`). */
+export function isWildcardValueType(t) {
+    return WILDCARD_VALUE_TYPES.has(t);
+}
+/** `true` iff `t` is a concrete scalar leaf (`string` / `number` / `boolean` / `date`). */
+export function isConcreteScalar(t) {
+    return !isWildcardValueType(t);
+}
+/**
+ * `true` iff `{ a, b } === { "date", "string" }` (in either order).
+ *
+ * `date` is a SPECIALIZATION of `string`: a `date` value IS a string in JSON
+ * (the Temporal runtime serializes to JSON, so catalogs model dates with
+ * `z.string()`, never `z.date()`). So `date → string` is guaranteed
+ * assignable, and `string → date` is treated permissively — an arbitrary
+ * string MAY be a valid date, so flagging it would be a false positive. This
+ * is the "author-may-tighten" rule surfaced by the registry data-fix.
+ */
+function isDateStringPair(a, b) {
+    return (a === "date" && b === "string") || (a === "string" && b === "date");
+}
+/**
+ * Position-aware assignability, WHOLE-STRING semantics — the case where a
+ * `{{ steps.x.output.y }}` token IS the entire field value, so the
+ * consumer field receives `y`'s raw (type-preserving) value.
+ *
+ * The lattice:
+ *
+ *   - Either side a wildcard (`unknown` / `object` / `array`) → assignable
+ *     (permissive; zero false positives).
+ *   - `date` ↔ `string` → assignable ({@link isDateStringPair} — dates ARE
+ *     JSON strings).
+ *   - Otherwise both CONCRETE scalars → assignable iff EQUAL. Two disjoint
+ *     concrete scalars (e.g. a `number` output into a `string`-expecting
+ *     input) are the ONLY thing this function flags.
+ *
+ * Interpolation (a `{{ … }}` embedded in surrounding text) is NOT checked
+ * through here: the result is always a string and every coarse producer is
+ * stringifiable, so interpolation never yields a type-mismatch verdict.
+ */
+export function isAssignable(producer, consumer) {
+    if (isWildcardValueType(producer) || isWildcardValueType(consumer)) {
+        return true;
+    }
+    if (producer === consumer)
+        return true;
+    return isDateStringPair(producer, consumer);
+}
+/**
+ * Coarse {@link FieldValueType} of a concrete JavaScript value — used to
+ * check a LITERAL (non-template) config value against its field's declared
+ * value type. `null` / `undefined` map to `unknown` (permissive) so an
+ * absent value is never a type mismatch (required-ness is a separate rule).
+ */
+export function jsValueType(value) {
+    if (value === null || value === undefined)
+        return "unknown";
+    if (Array.isArray(value))
+        return "array";
+    switch (typeof value) {
+        case "string":
+            return "string";
+        case "number":
+            return "number";
+        case "boolean":
+            return "boolean";
+        case "object":
+            return "object";
+        default:
+            // function / symbol / bigint — never a legitimate config leaf.
+            return "unknown";
+    }
+}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@flowget/graph-validation",
+  "version": "0.1.0",
+  "description": "Isomorphic, zero-runtime-dependency static validator for Flowget workflow graphs — the single source of validation logic so the builder's pre-submit verdict and the worker's pre-flight verdict are equal by construction. Template-grammar classifier, reference/reachability walker, coarse value-type lattice, and declarative field rules.",
+  "keywords": [
+    "flowget",
+    "workflow",
+    "workflow-engine",
+    "workflow-automation",
+    "validation",
+    "graph",
+    "template",
+    "typescript"
+  ],
+  "license": "FSL-1.1-ALv2",
+  "homepage": "https://docs.flowget.io",
+  "bugs": {
+    "url": "https://github.com/flowgethq/graph-validation/issues"
+  },
+  "author": "Flowget",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/flowgethq/graph-validation.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "lint": "eslint src/",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "@flowget/types": ">=0.5.0 <1.0.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9",
+    "@flowget/types": "^0.5.0",
+    "eslint": "^9",
+    "typescript": "^5",
+    "typescript-eslint": "^8",
+    "vitest": "^2"
+  }
+}